Who Should Control My Website Hosting Account?
Choose a website hosting account arrangement with clear billing, administrator access, recovery, support responsibilities and exit terms.
Part of our guide: Who Owns Your Business Website? Domains, Content, Hosting and Access Explained
Your business should have a clear, documented route to control and recover its hosting service. Day-to-day management can be delegated to an agency or specialist without making the business dependent on one person’s private account.
The right arrangement depends on who can maintain the system and what the hosting contract includes.
Separate ownership from administration
The account owner may control billing, recovery and administrator invitations. A technical administrator may deploy code or manage settings. A content editor may only update pages.
Use these roles deliberately where the provider supports them. Giving everyone the same administrator login makes responsibility and offboarding harder.
Business control does not mean every employee needs technical permissions.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Business-owned hosting
A business-owned account can make billing and supplier changes straightforward. The agency receives appropriate access and the business retains the account relationship.
This arrangement still needs a maintenance agreement. Owning the account does not mean the business knows how to patch software, monitor failures or restore data.
Confirm who responds to incidents and which tasks are included in support.
Agency-managed hosting
An agency may host several customers within a managed environment. That can provide convenient support and maintenance.
Ask what happens if you leave or the agency becomes unavailable. Establish export rights, handover costs, backups, notice periods and the process for appointing another supplier.
Do not assume a login to a customer dashboard grants control of the underlying hosting account.
Check recovery and billing
Record the provider, account reference, renewal cycle, payment method and authorised recovery contacts.
Use business-controlled recovery arrangements and suitable multi-factor authentication. Protect recovery codes and document who can use them.
A failed card or departed employee should not become a surprise outage. Check that renewal notices reach a monitored address.
Identify what else the account contains
Hosting may also include email, DNS, certificates, backups, databases or domain registration. Cancelling a package can affect more than the website.
Map these dependencies before making changes. The DNS guide and email during a rebuild explain common connections.
Ask the provider to confirm which services remain active after a transfer or cancellation.
Agree backup responsibility
Know who creates backups, where they are stored, how long they are retained and who tests recovery.
A provider’s infrastructure redundancy is not necessarily a recoverable copy of your deleted content. Read the service terms and test the process.
See website files and backups for the materials needed to restore the actual site.
Plan access changes carefully
When a supplier leaves, identify their accounts, tokens and automation before revoking access. Replace necessary credentials and verify the site still operates.
Avoid deleting a service account merely because its name resembles a former developer. It may run deployment or certificate renewal.
Keep a record of the change and the person who authorised it.
Questions to ask before agreeing
Distinguish the infrastructure from the support arrangement using shared versus managed hosting. A package label alone does not define who handles updates or recovery.
Ask who holds the account, who pays, who can recover access, what support covers, what can be exported and how an exit works.
Request answers in writing and keep them with the wider website ownership inventory.
The best arrangement makes accountability clear and matches the team’s ability to operate the service. Vendor lock-in explains the trade-offs, and contacting AfterWorks is a useful next step if your current hosting responsibilities are unclear.
